Ensure CICD releases tag the correct commit

.github/workflows/contraqctor.yml

@@ -2,6 +2,18 @@ name: contraqctor test suite
 
 on:
   workflow_dispatch:
+    inputs:
+      bump_type:
+        description: "Version bump type"
+        required: false
+        default: "rc"
+        type: choice
+        options:
+          - rc
+          - patch
+          - minor
+          - major
+          - stable
   pull_request:
   push:
     branches:
@@ -102,9 +114,8 @@ jobs:
 
       - name: Get version
         id: get_version
-        shell: bash # interop with win/linux for if statement
         run: |
-          version=$(uv version --output-format json | jq -r '.version')
+          version=$(uv run uv version --short)
           echo "version=$version" >> $GITHUB_OUTPUT
 
       - name: Create GitHub Release
@@ -128,13 +139,15 @@ jobs:
   # │                                                                 │
   # ╚─────────────────────────────────────────────────────────────────╝
 
-  github-public-release:
+  prepare-public-release:
     runs-on: ubuntu-latest
-    name: Create GitHub public release
+    name: Prepare files for public release
     needs: tests
-    if: github.event_name == 'release' &&
-      github.event.action == 'published' &&
-      !github.event.release.prerelease
+    if: github.event_name == 'workflow_dispatch'
+    outputs:
+      version: ${{ steps.get_version.outputs.version }}
+      is_prerelease: ${{ steps.check_prerelease.outputs.prerelease }}
+
     steps:
       - uses: actions/checkout@v5
         with:
@@ -145,28 +158,113 @@ jobs:
         with:
           enable-cache: true
 
-      - name: Get release version from tag
+      - name: Get target version
         id: get_version
-        run: echo "version=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
+        run: |
+          # Use bump type from input (defaults to rc)
+          bump_type="${{ github.event.inputs.bump_type || 'rc' }}"
+          echo "Bumping version with type: $bump_type"
+
+          # Handle version bumping based on type
+          if [[ "$bump_type" == "rc" ]]; then
+            # Handle rc bumping logic (same as in github-rc-release)
+            if uv version --bump rc --dry-run; then
+              uv version --bump rc
+            else
+              uv version --bump rc --bump patch
+            fi
+          else
+            # Handle patch, minor, major, stable
+            uv version --bump $bump_type
+          fi
 
-      - name: Validate version tag format
+          release_version=$(uv run uv version --short)
+          echo "version=$release_version" >> $GITHUB_OUTPUT
+          echo "Release version will be: $release_version"
+
+      - name: Validate version format
         run: uv version ${{ steps.get_version.outputs.version }} --dry-run
 
       - name: Update package version
         run: uv version ${{ steps.get_version.outputs.version }}
 
-      - name: Commit version
+      - name: Commit version and create tag
         run: |
           git config --global user.name "github-actions[bot]"
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git add .
-          git commit -m "Set version [skip ci]" || echo "No changes to commit"
+          git commit -m "Release v${{ steps.get_version.outputs.version }} [skip ci]"
+          git tag -a "v${{ steps.get_version.outputs.version }}" -m "Release v${{ steps.get_version.outputs.version }}"
           git push origin main
+          git push origin "v${{ steps.get_version.outputs.version }}"
+
+      - name: Determine if prerelease
+        id: check_prerelease
+        shell: bash
+        run: |
+          version="${{ steps.get_version.outputs.version }}"
+          if [[ "$version" == *"rc"* ]]; then
+            echo "prerelease=true" >> $GITHUB_OUTPUT
+          else
+            echo "prerelease=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: v${{ steps.get_version.outputs.version }}
+          name: Release v${{ steps.get_version.outputs.version }}
+          generate_release_notes: true
+          prerelease: ${{ steps.check_prerelease.outputs.prerelease }}
+          body: |
+            Release v${{ steps.get_version.outputs.version }}
+
+            This release was manually triggered.
+
+  publish-to-pypi:
+    runs-on: ubuntu-latest
+    name: Publish to PyPI
+    needs: [tests, prepare-public-release]
+    if: |
+      (github.event_name == 'workflow_dispatch') ||
+      (github.event_name == 'release' &&
+       github.event.action == 'published' &&
+       !github.event.release.prerelease &&
+       startsWith(github.ref, 'refs/tags/v'))
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && 'main' || github.ref_name }}
+
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+
+      - name: Verify version consistency (for automatic releases)
+        if: github.event_name == 'release'
+        shell: bash
+        run: |
+          tag_version=$(echo "${{ github.ref_name }}" | sed 's/^v//')
+          package_version=$(uv run uv version --short)
+          if [[ "$tag_version" != "$package_version" ]]; then
+            echo "ERROR: Tag version ($tag_version) doesn't match package version ($package_version)"
+            exit 1
+          fi
+          echo "✅ Version consistency verified: $tag_version"
+
+      - name: Get current version (for manual releases)
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          package_version=$(uv run uv version --short)
+          echo "📦 Publishing version: $package_version"
 
       - name: Build
         run: uv build
 
-      - name: Publish
+      - name: Publish to PyPI
         run: uv publish --token ${{ secrets.AIND_PYPI_TOKEN }}
 
   # ╔─────────────────────────╗
@@ -180,8 +278,8 @@ jobs:
   build-docs:
     name: Build and deploy documentation to GitHub Pages
     runs-on: ubuntu-latest
-    needs: github-public-release
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    needs: publish-to-pypi
+    if: github.event_name == 'release' && !github.event.release.prerelease
     steps:
       - name: Checkout
         uses: actions/checkout@v5